2 ms·
The author is in a large University context where getting everybody who runs all the web servers (various departments, schools, etc) to add headers probably is
by EvanAnderson 5y ago
The author is in a large University context where getting everybody who runs all the web servers (various departments, schools, etc) to add headers probably is really difficult (especially when you consider potentially closed-source applications or embedded devices that aren't easily updated).
- jabbany 5y agoIt's not that hard though given we're working with HTTP... Since they control the network (DNS and all) couldn't they just wrap non-compliant devices behind a forwarding proxy that adds those headers? Like rather than resolve to the device, resolve to a proxy that adds those headers.
- EvanAnderson 5y agoNo, it's not particularly hard, but it is complicating the plumbing. We have to make the Internet safe for manufacturers of devices who can't be bothered to incorporate a modicum of security in their devices.
- jabbany 5y agoI do agree with this. It's too much mollycoddling from browsers and in fact dis-incentivizes manufacturers to fix the real CSRF vulnerabilities... Heaven forbid if someone joins your LAN with a device running an old/weird browser that doesn't do this preflighting and your intranet just gets caught with its pants down...